Design cannabis facilities in layers, not as a device list

Cannabis facility security often grows one purchase at a time. A camera covers a problem area, then a gate or credential reader is added when traffic and inventory change. The equipment may work, yet the facility still lacks a coherent design.

A layered program starts with the business and the site. It treats the property, perimeter, building, interior zones, technology, people, and response procedures as parts of the same operating plan. Changes can then be reviewed before they create blind spots, conflicting controls, or unapproved premises alterations.

Oregon requires a cannabis license applicant to have an approved security plan before the pre-licensing inspection. The rules also require prior approval for material or substantial changes to a licensed premises. That includes physical changes that require more cameras or a change to the security system. OLCC's 2025 compliance bulletin further advises licensees that a security-system change should be submitted as a premises alteration amendment.

Facility planning therefore belongs early in site selection, design, construction, and expansion. Moving a doorway, changing the use of a room, extending cultivation space, or rerouting deliveries can affect access, surveillance, alarm coverage, emergency movement, and the approved plan at the same time. A four-layer working model gives operators a practical way to review those effects. It is not an OLCC-defined framework.

Site layer

The site layer covers the conditions around the licensed operation. Review property boundaries, adjacent uses, public approach, staff and visitor movement, deliveries, utilities, lighting, and emergency access. Map normal movement, responder access, and the points where an abnormal condition could interrupt operations.

This review should stay practical. A rural producer, an urban retailer, and a processor in a shared commercial area face different traffic, visibility, weather, and infrastructure conditions. Their security plans should reflect those differences instead of copying one standard drawing.

Perimeter and building layers

Make the controlled boundary obvious. Fences, gates, exterior lighting, vehicle controls, signage, and detection measures should support that boundary without interfering with emergency access or creating unsafe circulation.

The building layer carries the next part of the load. Oregon rules require commercial-grade, non-residential locks on external doors and applicable gates where marijuana items are present. Oregon generally requires an operational alarm when the premises is closed, subject to a narrow exception when an authorized representative is continuously present. Surveillance rules set coverage, failure-notification, recording, backup, and retention requirements.

Commission each control against a written acceptance test. Confirm that doors close and latch, credentials match approved roles, and alarm zones report correctly. Check required camera views, timestamp agreement, failure notifications, recording retrieval, and backup power.

Interior layer

Interior zoning should follow the operation. Production, processing, inventory, sales, surveillance equipment, administration, utilities, and waste handling may each carry different access, observation, environmental, and continuity needs. Oregon requires producers to prevent public access to production areas. Required camera coverage includes limited access areas and their access points, the surveillance area, waste areas, and other locations named in the rule.

Good interior design supports safe work. Employees should understand where they can go, visitors should be managed, and emergency routes should remain usable. Security equipment should not create a life-safety conflict. Fire, building, electrical, accessibility, and occupational requirements must be confirmed with the professionals and authorities responsible for the actual project. In Oregon, that means coordinating the current state fire and building codes with the local authority having jurisdiction, not relying on a generic claim of "NFPA compliance."

Plan for change

Equipment fails, vegetation grows, workstations move, vendor relationships change, and the business adds new processes. Maintenance records, incident findings, employee feedback, and periodic walkthroughs should trigger a documented review. Owners can then decide whether a correction is routine, whether the security plan needs revision, and whether OLCC approval is required before work begins.